From: security-alert@paypa1-verify.com SPOOFED DOMAIN
Subject: URGENT: Your account will be suspended! URGENCY TACTICS
Reply-To: different-address@gmail.com MISMATCH
Link: http://paypal-secure-login.malicious.ru/verify SUSPICIOUS URL
SPF: FAIL AUTHENTICATION FAILED
DKIM: Not present MISSING
Attachment: invoice.pdf.exe EXECUTABLE
Domain typosquatting detected (paypa1 vs paypal)
Urgency language: "URGENT", "suspended"
Executable disguised as PDF attachment
Reply-To address differs from sender
SPF authentication failed
Link points to foreign TLD (.ru)